Password Manager RFC

[gkainz]

Looking for comments, suggestions, reviews of password manager/keeper app to support 5-6 users

1. windows desktop
2. mobile (iphone, blackberry)
3. sync to desktop
4. sync with or refresh from central file/db


At a prior client I/they used KeePass - it did have a blackberry app but mobile to desktop sync never worked.

 

[JeffDG]

Lastpass works.

 

[mikea]

Have you heard about Lastpass? https://lastpass.com/

 

[gkainz]

a cute little cartoonish sales pitch leads me to believe it's mostly (or specifically?) web based? None of mine are web based accounts. I need to store and retrieve passwords for servers and databases - usually 5 accounts per server, for a dozen servers. Password changes done regularly and then shared with SA and DBA team.

 

[mikea]

a cute little cartoonish sales pitch leads me to believe it's mostly (or specifically?) web based? None of mine are web based accounts. I need to store and retrieve passwords for servers and databases - usually 5 accounts per server, for a dozen servers. Password changes done regularly and then shared with SA and DBA team.

LastPass is a cloud-based locker.,
You can store anything. I have my drug list on it as free text and I use web access to retrive it. I just havent' gotten a round tuit to buy the phone client. With that at a doctor's office I could just show the list on the phone.

LastPass has browser add-ins to save and populate web forms, and mobile clients for IOS and Android.

For your server SA info you could just create a dedicated account and share the password.

If you just want a secure store that you can set up multiple accounts and access rights try SpiderOak. It has the best encryption policy....nobody can ever get your data. (PM me your email address and I'll send a referral and get more space.)

 

[denverpilot]

Looks nifty but someone in Marketing applied their special kind of math to what the engineers actually told them...

"SpiderOak was designed and implemented by engineers with a background in fault tolerant systems with a margin of error of 0.0000%."

 

[Jim_R]

I too have been satisfied with Lastpass. Note that it includes the ability to share login information with other users; personally, I've never needed to share login credentials with anyone, so I don't know how that works or if that feature would meet your needs.

 

[denverpilot]

The entire concept of sharing login credentials is a root-cause security problem in the original RFC.

Systems don't have logins. People do.

If a system can't log a single human in and allow that human appropriate privilege without having to utilize a single system wide password, the system itself is poorly designed.



Funny how Unix got this right with sudo over 20 years ago... and so much stuff afterward gets it so very very wrong.

I won't go so far as to say everything should also have two-factor authentication, but we're up to 2012 now. Most things really should...

 

[Jim_R]

If a system can't log a single human in and allow that human appropriate privilege without having to utilize a single system wide password, the system itself is poorly designed.

Indeed. Thank goodness I live in a world where resources are unlimited, everything is perfectly designed, and compromise is never required.

 

[denverpilot]

Indeed. Thank goodness I live in a world where resources are unlimited, everything is perfectly designed, and compromise is never required.

Compromise on user authentication is not only dangerous, it could be considered gross negligence today. In Court. Later. When sensitive data goes missing.

I'm picking a little on you because it's pretty easy to do this one right on most systems, and it's just that I don't know any modern operating systems that don't support individual logins.

Hell, we used to copy the /etc/passwd and /etc/shadow files by hand, but we never handed root to everyone. In the time for the search for sharing one password, that could have been automated on Unix. Windows too.

Sooooo... What kind of system is it? I'm curious. If it has the ability to do individual logins, I'll ask the standard question...

"If you don't have time/resources to do it right, where will you find time/resources to fix it later?"

User authentication is way too basic not to do right. FreeRADIUS and/or OpenLDAP and various other tools are quite literally, free. And can be run on a pair of complete junk servers.

I know 'cause I just decommissioned the company's original pair of Dell 1750s that did the job without fail for almost 10 years.

We have other compromises we want fixed, but logins per user and the ability to disable any account at a moment's notice parallels the real world since people leave, get fired, and die with regularity in anyplace big enough to need a password sharing system.

Think about it carefully. I've heard that excuse before and the systems always had to be reworked later after it was a lot more expensive in terms of man-hours and risk... since it required reconfiguration of Production 24/7 systems by the time it became "important enough".

Just trying to save you the mistakes I've seen before. Just like my Flight Instructors have done for me. It's not in a sprit of meanness, more in terms of "pay it forward".

A shared password list system will bite you in the butt. Hard. I've seen it happen. Just a warning.

 

[silver-eagle]

The entire concept of sharing login credentials is a root-cause security problem in the original RFC.

Systems don't have logins. People do.

If a system can't log a single human in and allow that human appropriate privilege without having to utilize a single system wide password, the system itself is poorly designed.



Funny how Unix got this right with sudo over 20 years ago... and so much stuff afterward gets it so very very wrong.

I won't go so far as to say everything should also have two-factor authentication, but we're up to 2012 now. Most things really should...

There are holes big enough to drive an Airbus a380 through in sudo. I would rather authorize the user for su than sudo any time. sudo's only advantage is logging of the command. If su did that, life would be good and you would not need sudo.
sudo left management with a false sense of security which many sites are just learning.

 

[Jim_R]

I'm picking a little on you because it's pretty easy to do this one right on most systems.

Well, you're picking on the wrong person. I'm not the OP, and I'm not a sysadmin. I'm a user, and all I know is that I have experience with multi-layered IT security schemes that include _both_ user-level and group-level authentication. Whether there were valid or invalid reasons for that design, I don't know and am not capable of debating.

 

[gkainz]

yeah but .... the OP didn't advocate account sharing for normal day-to-day use (and maybe neither did you - I just skimmed when the discussion took a slight detour). I don't advocate account sharing except where the app insists, e.g. root, oracle (account login), sys, system, dbsnmp, etc (database accounts), and these accounts are not used for regular use.
They are changed on a regular basis and are on "need to know" for the s/a and dba team.

 

[denverpilot]

Yeah sorry. I mixed up OP and a commenter. And sudo was just an example of a bare minimum compared to sharing passwords.

You can always still use sudo for su itself and at least have a log of who blew up the box later, for those pesky DBAs. HA! (There's a security hole for ya.)

Assuming they don't panic and try to remove the evidence...

Seen lots of dumb stuff before...

Dude blew up an entire datacenter by mucking with a core switch/router during Production day. TACACS logs told the story. Fired on the spot. He'd had two warnings already about messing around and causing outages.

Place had automated backups of the core. Once someone finally figured out it was human error causing the outage, they found the differences between the running config and the one on disk (happened to be on one of "my" core Unix boxes for storage space, which is how I was involved) and they put Humpty Dumpy back on the wall.

Nice guy but couldn't get it through his head that the maintenave window rules applied to him and his fancy CCIE number, too.